An Anthem, Inc. (IN) employee emailed PHI to himself, claiming it was for commission reconciliation purposes. The breach, affecting 3,525 individuals, was submitted to HHS on 2016-10-26. PHI was located in email. The employee resigned and attested to deleting all PHI from personal devices. Anthem retrained its Medicare sales workforce and updated commission statements to limit PHI. OCR obtained written assurances of corrective action implementation.
Affected (this filing): 3,525